Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/markdown/document.h">

<violation number="1" location="src/core/markdown/document.h:135">
P3: When a fresh `StringArena` receives a zero-size allocation, `cursor_ += size` performs pointer arithmetic on `nullptr`, which is undefined behavior. Return before the pointer arithmetic for `size == 0`.</violation>
</file>

<file name="src/core/markdown/scanners.h">

<violation number="1" location="src/core/markdown/scanners.h:301">
P2: When an HTML comment has a dash immediately before its closing `-->`, `scan_html_comment` misses the overlapping terminator and treats valid raw HTML as ordinary text. Detect the first `-->` substring directly or preserve the overlapping dash.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/html/include/sourcemeta/core/html_buffer.h">

<violation number="1" location="src/core/html/include/sourcemeta/core/html_buffer.h:87">
P1: A fresh buffer has null pointers, but `size()`, `capacity()`, and the append paths subtract them before allocation, which is undefined behavior. This affects empty-buffer calls, `HTMLWriter::reserve()`, and every buffer after `take()`. Keep an always-valid empty pointer range or guard null state before every pointer subtraction, including the state restored by `take()`.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="test/markdown/markdown_autolinks_test.cc">

<violation number="1" location="test/markdown/markdown_autolinks_test.cc:308">
P2: This expectation does not match the current parser and makes the test fail: `_` is an allowed autolink delimiter, so the URL is linked before emphasis is applied. Update the expected output to include the link, or change the parser if rejecting underscore-delimited autolinks is intentional.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/markdown/document.h">

<violation number="1" location="src/core/markdown/document.h:71">
P2: When a Markdown input exceeds 4 GiB, `Node::content_offset` and `content_length` truncate source positions. Reject oversized inputs or use `std::size_t` for content offsets and lengths throughout the parser.</violation>
</file>

<file name="src/core/markdown/render.h">

<violation number="1" location="src/core/markdown/render.h:151">
P2: When an image description contains a resolved footnote reference, `alternative_text()` omits the reference number from `alt` even though the renderer emits that number as visible text. Include `FootnoteReference` in the plain-text cases so image alternatives reflect their descendants.</violation>

<violation number="2" location="src/core/markdown/render.h:151">
P3: Image alt text includes raw HTML markup instead of stripping it. When an image label contains an inline HTML tag, `alternative_text()` appends the `HTMLInline` literal, so the generated accessible name contains escaped `<tag>` text. Exclude `NodeType::HTMLInline` from the appended-text branch.</violation>
</file>

<file name="src/core/markdown/postprocess.h">

<violation number="1" location="src/core/markdown/postprocess.h:118">
P2: When an unreferenced footnote definition contains a reference to another definition, this loop still promotes the nested definition into the rendered footnotes because definitions are not detached until after reference resolution. Exclude references under definitions that are not externally referenced before assigning footnote numbers.</violation>

<violation number="2" location="src/core/markdown/postprocess.h:186">
P2: When an image alt text contains an email address after other text, this traversal creates an autolink inside the image's alt-text subtree. Skip `NodeType::Image` alongside `NodeType::Link` so postprocessing only links email text rendered as document content.</violation>
</file>

<file name="src/core/markdown/scanners.h">

<violation number="1" location="src/core/markdown/scanners.h:305">
P2: Inline declarations without whitespace after the uppercase name, such as `<!A>`, are rejected even though the block scanner accepts them as GFM HTML declarations. Remove the mandatory whitespace requirement and scan for `>` directly after the declaration name.</violation>

<violation number="2" location="src/core/markdown/scanners.h:809">
P2: When a table cell contains an even-length run of backslashes before `|`, this keeps an unescaped pipe inside the cell. Count consecutive preceding backslashes and split the cell only when that count is even.</violation>
</file>